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REVIEW OF NSA/CSS INFORMATION INTENDED FOR PUBLIC RELEASE 

PURPOSE AND SCOPE 

This document sets forth the policy, procedures, and responsibilities governing the 
vrevublication review of official NSA/CSS information intended for public release by current and 
former NSA/CSS affiliates in either an official capacity or a private capacity . This policy also 
implements Department of Defense (DoD) Directive 5230.09, “Clearance of DoD Information 
for Public Release” (Reference a) . 

This policy applies to all current and former NSA/CSS affiliates and reflects lifetime 
obligations agreed to in non-disclosure asreements . 


Is/ 

ELIZABETH R. BROOKS 
Chief of Staff 


_ Is/ _ 

Endorsed by 

Associate Director for Policy 


Policy 1-30 is approved for public release. 
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DISTRIBUTION: 

P12 

P13 

P131 

PI34 (Vital Records) 

This Policy supersedes NSA/CSS Policy 1-30 dated 10 May 2013. The Chief, Policy approved 
an administrative update on 12 May 2017 to update organizational designators forNSA21. 

OPl: Information Security and Classification Division, P131,972-2534 (secure) or (443)-634- 
4094 (non-secure). 


POLICY 

1. Public release in an official capacity: 

a. NSA/CSS makes certain accurate and timely information available to the public 
to promote accountability for and understanding of its activities. The public release of 
official NSA/CSS information shall be limited only as necessary to safeguard information 
requiring protection in the interest of national security or other legitimate Government 
interest (Reference a) . All current NSA/CSS affiliates shall submit for prepublication 
review all official NSA/CSS information intended for public release in their official 
capacity. The prepublication review process includes both a classification review and a 
review that determines whether the information intended for public release: is consistent 
with established NSA/CSS, DoD, and Intelligence Community policies and programs; is 
consistent with information security standards established by the Office of Information 
Management (OIM, PI3); and conforms to NSA/CSS corporate messaging standards as 
determined by Strategic Communications (P2). 

b. Official NSA/CSS information prepared as part of official duties and approved 
for public release will be used in accordance with DoD Directive (DoDD) 5500.07, 
“Standards of Conduct” (Reference b) . and DoD 5500.7-R, “Joint Ethics Regulation 
(JER)” (Reference c) , which preclude such use for monetary or nonmonetary personal 
gain. 

2. Public release in a private capacity: NSA/CSS affiliates acting in a private capacity, 
and not in connection with their official duties, may prepare information for public release 
without management approval or policy review provided that the affiliate: 

a. Violates no laws or regulations; 

b. Maintains ethical standards and compliance with References b and c; 

c. Uses only information that is UNCLASSIFIED and approved for public 

release; 

d. Uses no information in which NSA/CSS may have intellectual property rights 
and must file a new patent application with the U.S. Patent and Trademark Office thereon 
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or lose the right to do so (i.e., the information, if publicly released, does not establish a 
date by which NSA/CSS must file a new patent application (e.g., 1 year after public 
release)); and 

e. Uses a disclaimer on any material in which an NSA/CSS affiliation is cited, 
stating that the views and opinions expressed are those of the affiliate and do not reflect 
those of NSA/CSS. 

3. Information available from both classified and open sources: 

a. Official NSA/CSS information appearing in the public domain shall not be 
automatically considered UNCLASSIFIED or approved for public release. 

b. Where information intended for public release is available to the NSA/CSS 
affiliate from classified sources and also independently from open sources, the affiliate 
may be permitted to release the information if the affiliate can cite an adequate open- 
source publication where the specific information is available - only if release of the 
information by the affiliate at the time of review will not cause additional damage to 
national security through confirmation of previous unauthorized releases. The 
appropriate Prepublication Review Authority shall exercise discretion in making such 
determinations on a case-by-case basis and may consider the following as factors in the 
decision: 


1) The sensitivity of the information from classified sources; 

2) The number and currency of the previous releases; 

3) The level of detail previously exposed; 

4) The source of the previous releases (whether authoritative and 
acknowledged or an anonymous leak); 

5) The submitter’s aeeess to classified sources; and 

6) The authority and eredibility afforded by the affiliate’s NSA/CSS 
experience. 

4. Official NSA/CSS organizational logos: A /ogo may be created in accordance with 
NSA/CSS Policy 10-7, “NSA/CSS Multimedia Information’’ (Referenee d) . Once Graphies 
Services (P2212) creates a proof of the logo, it must be reviewed and approved for public release 
in an official capacity as set forth in this policy. Once approved for public release, a logo may be 
used for official NSA/CSS operational, promotional, or morale-building purposes. 
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PROCEDURES 

5. For public release in official capacity: 

a. Information intended for public release in anNSA/CSS affiliate’s official 
capacity (including, but not limited to, books, articles, videos, speeches, conference 
briefings, Internet postings, biographies, book reviews, cooperative education (co-op) 
reports, press releases, research papers, and organizational logos) is subject to 
prepublication review. 

b. Before publicly disclosing his or her NSA/CSS affiliation, a current affiliate 
preparing material for public release in an official capacity shall seek operations security 
(OPSEC) guidance from his or her Staff Security Officer (SSO) and solicit a name check 
from Chief, NSA/CSS Cover Office (X073) in accordance with NSA/CSS Policy 1-18, 
“NSA/CSS Cover Program” (Reference ef 

c. Whenever practicable, to preclude the inadvertent spillage of classified 
information onto unclassified systems, NSA/CSS affiliates acting in an official capacity 
shall use a TOP SECRET classified information system (e.g., NSANet, J WICS) to draft 
the full material intended for public release. Notes, outlines, or other partial information 
may not be substituted for the full material intended for public release in order to avoid 
the possibility of classification due to compilation. 

d. Current NSA/CSS affiliates acting in an official capacity shall first submit, for 
management review and approval, all official NSA/CSS information intended for public 
release. 


e. Upon receipt of management approval for public release (which may be in the 
form of a digitally signed email), a current NSA/CSS affiliate acting in an official 
capacity submits the following to a local Classification Advisory Officer (CAP) for an 
initial classification determination: the full material intended for public release, 
management approval, and written consent from NSA/CSS affiliates identified in the 
information to have any NSA/CSS affiliation publicly revealed. A complete list of CAOs 
can be found on NSANet (“ go cao ”). 

f. Upon determining the information to be UNCLASSIFIED, the CAO sends a 
digitally signed email to the affiliate containing that determination. 

g. Following procedures established by the Prepublication Review Authority, 
either the affiliate or the local CAO then forwards the full and final material intended for 
public release (with all classification markings and/or handling instructions removed), 
management approval, classification determination, written consent from affiliates 
identified in the information to have any NSA/CSS affiliation publicly revealed (if 
applicable), technical review (if applicable), and contracting officer approval (if 
applicable) to the appropriate NSA/CSS Prepublication Review Authority for the final 
prepublication review determination. 
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h. The appropriate Prepublication Review Authority shall; 

1) As necessary, coordinate with other information owners should the 
material contain information not under his or her purview; 

2) Refer the information for review to organizations external to NSA/CSS, 
if required; 

3) Coordinate, as appropriate, a review with the Public Affairs Office 
(PAO, P2l) to determine that information intended for public release in an 
affiliate’s official capacity conforms to NSA/CSS corporate messaging standards; 

4) When necessary, request a technical review by a subject matter expert 
to determine that the information intended for public release is accurate; 

5) When necessary, request a review by the NSA/CSS Office of the 
General Counsel (OGC) to determine that the information intended for public 
release contains no information in which NSA/CSS may have intellectual 
property rights and may file a patent application thereon; and 

6) If the current NSA/CSS affiliate acting in an official capacity is a 
Senior Leader , coordinate with the Information Security and Classification 
Division (PI31) to obtain prepublication approval from the Defense Office of 
Prepublication and Security Review (DOPSR). 

i. The appropriate Prepublication Review Authority will issue, as practicable, a 
final determination to the affiliate within 25 business days of receipt of all required 
information and supporting documentation. 

6. For public release in a private capacity: 

a. Resumes, associated cover letters, work-related biographies (bios), and 
curriculum vitae (CVs) intended for any public use: Current and former NSA/CSS 
affiliates shall submit resumes, associated cover letters, work-related bios, and CVs 
intended for public release to the Information Security and Classification Division (PI 31) 
for review according to procedures published on the Information Security and 
Classification Division (P131) Web site and on nsa.gov to determine whether they 
contain NSA/CSS protected information . 

1) Before publicly disclosing his or her NSA/CSS affiliation in such a 
document, a current affiliate shall seek OPSEC guidance from an SSO and solicit 
a name check from Chief, X073. 

2) Whenever practicable and with supervisory approval, to preclude the 
inadvertent spillage of classified information onto unclassified systems, current 
NSA/CSS affiliates acting in a private capacity may use a TOP SECRET 
classified information system (e.g., NSANet, JWICS) to draft the full version of 
such documents intended for public release. Notes, outlines, or other partial 
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information may not be substituted for the full material intended for public release 
in order to avoid the possibility of classification due to compilation. 

3) A current affiliate shall have such documents first reviewed by an 
organizational CAO before submitting it to P131. 

4) Former affiliates shall submit such documents per instructions in 
paragraph 6.b.4 . 

5) Resumes are not subject to management approval or policy review. 

b. Other than resumes: Current and former NSA/CSS affiliates may prepare 
material for public release that meets all of the requirements stated in paragraph 2 . This 
includes, but is not limited to, books, articles, videos, speeches, conference briefings, 
Internet postings, book reviews, co-op reports, press releases, research papers, and 
organizational logos. However, prepublication review is required where compliance with 
the requirements of paragraph 2 is in doubt (i.e., where the material contains official 
MSA/CSS information that may or may not be UNCLASSIFIED and approved for public 
release). Before publicly disclosing an NSA/CSS affiliation, a current affiliate shall seek 
OPSEC guidance from an SSO and solicit a name check from Chief, X073. 

1) Whenever practicable and with supervisory approval, to preclude the 
inadvertent spillage of classified information onto unclassified systems, current 
NSA/CSS affiliates aeting in a private capacity may use a TOP SECRET 
classified information system (e.g., NSANet, JWICS) to draft the full material 
intended for public release. Notes, outlines, or other partial information may not 
be substituted for the full material Intended for public release in order to avoid the 
possibility of classification due to compilation. 

2) A current affiliate with access to a TOP SECRET classified network 
(e.g., NSANet, JWICS) shall request review by his or her organization’s CAO of 
the full material intended for public release. After review, the organization’s 
CAO will send the full and final material and the initial determination to the 
appropriate Prepublication Review Authority for a second review. 

3) Current affiliates without access to a TOP SECRET classified network 
(e.g., NSANet, JWICS) may submit the full and final material intended for public 
release via another classified system (e.g., SlPRNet) to the appropriate 
Prepublication Review Authority according to established procedures. 

4) Former affiliates without access to a TOP SECRET classified network 
(e.g., NSANet, JWICS) shall submit the full and final material intended for public 
release in hardcopy to; 

NSA/CSS 

ATTN: P131, Prepublication Review 

9800 Savage Road 
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Suite 6932 

Fort George G. Meade, MD 20755-6248 

5) The appropriate Prepublication Review Authority shall ereate an 
official record of the documents reviewed and the determinations made. 

6) As necessary, the appropriate Prepublication Review Authority shall 
coordinate with other information owners when the material contains information 
under their purview. 

7) The appropriate Prepublication Review Authority shall, as practicable, 
issue the determination to the affiliate within 25 business days of receipt. 

7. Appeal of a prepublication review determination: 

a. A prepublication review determination may be appealed in writing to the Chief, 
OIM within 20 business days of receipt of the determination. At OIM’s discretion, an 
additional 30 business days may be allowed to file a written appeal, provided that the 
affiliate files a written notice of intent to appeal within 20 business days of receipt of the 
initial determination and presents justification to support an extension. The affiliate 
making the appeal shall specifically identify the disputed portions of the initial 
determination and the reasons for appeal - and shall include any supporting information 
that the Chief, OIM should consider. 

b. In support of OIM, the Information Security and Classification Division (P131) 
will, if necessary, schedule meetings with the NSA OGC and/or the information owners 
to review the disputed information and, within 30 business days of receipt of the appeal, 
advise the affiliate making the appeal of the Chiefs OIM final determination and, to the 
extent consistent with national security, the reasons for any OIM determination adverse 
to the affiliate’s interests. 

c. The final determination by the Chief, OIM may not be further appealed. 

RESPONSIBILITIES 

8. A current NSA/CSS affiliate acting in an official capacity shall: 

a. Before disclosing his or her NSA/CSS affiliation, solicit a name check from 
Chief, X073 in accordance with Reference e: 

b. Seek OPSEC guidance from an SSO regarding the possible consequences of 
disclosing his or her NSA/CSS affiliation; 

c. Submit for prepublication review all materials intended for public release 
according to the procedures specified in paragraph 5 : 
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d. As applicable, obtain written consent from each affiliate identified in the 
information to have his or her NSA/CSS affiliation publicly revealed; and 

e. In accordance with established procedures, submit to the appropriate 
Prepublication Review Authority his or her requests for prepublication review along with 
all required information identified in paragraph 5.g. . 

9. Current NSA/CSS affiliates acting in a private capacity shall: 

a. Before disclosing their NSA/CSS affiliation, solicit name checks from Chief, 
X073 in accordance with Reference e: 

b. Seek OPSEC guidance from an SSO regarding the possible consequences of 
disclosing their NSA/CSS affiliation; 

10. Current and former NSA/CSS affiliates acting in a private capacity shall: 

a. Submit for prepublication review all materials intended for public release 
according to the procedures specified in paragraph 6; 

b. Notify NSA/CSS of any request to comment on any unofficial NSA/CSS- 
related information (e.g., to review a book by a non-Govemment author prior to 
publication, to review an article). The NSA/CSS affiliate shall regard his/her comments 
as a proposed unofficial publication subject to review, as provided by this policy. If the 
appropriate Prepublication Review Authority determines that all or part of the text being 
commented on must be reviewed in order to evaluate the comments, the affiliate shall 
obtain permission from the author before submitting relevant parts of any unpublished 
text to NSA/CSS for review; and 

c. As applicable, obtain written consent from each affiliate identified in the 
information to have his or her NSA/CSS affiliation publicly revealed. 

11. Classification Advisory Officers (CAOs) shall: 

a. Conduct an initial classification review of information submitted by an affiliate 
in their supported organizations, in accordance with current NSA/CSS classification and 
declassification guidance; 

b. Provide the affiliate with a digitally signed email message or, if email is not 
practicable, an appropriately classified letter containing the classification determination; 
and 


c. In accordance with established procedures and on behalf of the affiliate, submit 
a request for prepublication review to the appropriate Prepublication Review Authority 
(see paragraph 5.g.) . 
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12. Prepublication Review Authorities shall; 

a. Assist the CAO, when necessary, in resolving classification disputes; 

b. Coordinate reviews, as appropriate, with PAO for conformance to messaging 
standards; 


c. If the current NSA/CSS affiliate acting in an official capacity is a Senior 
Leader, coordinate with the Information Security and Classification Division (PI 31) to 
obtain prepublication approval from the DOPSR; 

d. Coordinate prepublication reviews with any other NSA/CSS offices as required 
by, and specified in, this policy; 

e. Coordinate prepublication reviews with external information owners (e.g., U.S. 
Government, foreign government), as appropriate; 

f. Conduct, as practicable, final prepublication reviews of all information 
intended for public release within 25 business days of receipt; 

g. Notify the affiliate in writing of the determination; and 

h. Maintain all required electronic and hardcopy official records related to 
prepublication review determinations in aceordance with this policy and NSA/CSS Policy 
1-6, “Records Management Program” (Reference f) : 

13. The Information Security and Classification Division (PI 31) shall perform all of the 
functions of a Prepublication Review Authority (see paragraph 12) and shall; 

a. Serve as the sole approval authority for the public release of personal resumes; 

b. Coordinate with the DOPSR to obtain public release approval when the current 
NSA/CSS affiliate acting in an official capacity is a Senior Leader; 

c. Review and approve or disapprove management directives and any other 
procedures developed to implement this policy;' 

d. Maintain accountability and a database for all required electronic and hardcopy 
official records related to prepublication review determinations in accordance with 
Reference f ; and 

e. Administratively assist the Chief, OIM in the processing of prepublication 
review appeals. 

14. The Research Director, in addition to the responsibilities in paragraph 15. shall; 

a. Issue management directives to implement this policy that have been approved 
by the Information Security and Classification Division (P131); 
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b. Provide a monthly accounting of prepublication review cases to the Information 
Security and Classification Division (PI31); and 

c. Grant the Information Security and Classification Division (P131) access to any 
databases used for the electronic storage and tracking of prepublication review cases. 

15. The Directors, Cryptologic Center Commanders/Chiefs, and Field Commanders/ 
Chiefs shall: 


a. Develop a process, consistent with the provisions in this policy, for ensuring 
the proper prepublication review of official NSA/CSS information intended for public 
release; 


b. Ensure that personnel under their supervision are made aware of the 
requirements of this policy; and 

c. Ensure that subordinates’ requests for management review and approval of 
official NSA/CSS information intended for public release pursuant to paragraph 5.b are 
completed in a timely manner. 

16. The Security and Counterintelligence Group (A5) shall: 

a. Ensure that, during initial indoctrination, all affiliates are informed of their 
lifelong responsibility to safeguard NSA/CSS protected information and of the 
procedures for prepublication review; 

b. Ensure that all affiliates are reminded of their lifetime prepublication review 
responsibilities prior to signing their security debriefing forms at the end of their 
affiliation with the Agency; and 

c. Via SSOs, provide OPSEC guidance to current affiliates regarding the possible 
consequences of publicly disclosing their NSA/CSS affiliation when preparing official 
NSA/CSS information for public release in either an official or private capacity. 

17. The Office of General Counsel (OGC) shall: 

a. Provide legal advice to a Prepublication Review Authority when material 
intended for public release contains any information in which NSA/CSS may have 
intellectual property rights and may file a patent application thereon; 

b. Ensure, in coordination with the Business Management and Acquisition 
Directorate (B), that contraets contain necessary provisions to require compliance with 
the provisions of this policy by contractors and their employees; and 

c. Provide legal advice and guidance to the Information Security and 
Classification Division (P131) and Chief, OIM during the appeal process, as necessary 
and as required. 
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18. The Business Management and Acquisition Directorate (BM&A) shall ensure, in 
coordination with the OGC, that contracts contain necessary provisions to require compliance 
with the provisions of this policy by contractors and their employees. 

19. The Public Affairs Office (PAO) shall, as appropriate, perform a review on all 
information intended for public release in an official capacity within 10 business days of receipt 
to ensure that information intended for public release conforms to current NSA/CSS messaging 
standards as determined by Strategic Communications. 

20. The Chief, NSA/CSS Cover Office {X073) shall conduct name checks as requested 
by current affiliates preparing official NSA/CSS information for public release in either an 
official or private capacity in accordance with Reference e. 

REFERENCES 


21. References: 

a. DoDD 5230.09 “Clearance of DoD Information for Public Release,” dated 
22 August 2008. 

b. DoDD 5500.07 . “Standards of Conduct,” dated 29 November 2007. 

c. DoD 5500.7-R. “Joint Ethics Regulation (JER),” dated 1 August 1993. 

d. NSA/CSS Policy 10-7. “NSA/CSS Multimedia Information,” dated 
12 August 2009 and revised 1 May 2013. 

e. NSA/CSS Policy 1-18. “NSA/CSS Cover Program,” dated 6 March 2014. 

f NSA/CSS Policy 1-6 . “Records Management Program,” dated 
19 November 2014. 

g. Executive Order 13526. “Classified National Security Information,” dated 
25 January 2010. 

h. Public Law No. 86-36 (codified as amended in 50 U.S.C. § 3605), “National 
Security Agency Act of 1959.” 

i. 5 U.S.C § 552. “Freedom of Information Act.” 

DEFINITIONS 

22. Affiliate - A person employed by, detailed to, or assigned to NSA/CSS, including a 
member of the U.S. Armed Forces; an expert or consultant to NSA; an industrial or commercial 
contractor, licensee, certificate holder, or grantee of NSA, including all subcontractors; a 
personal services contractor; or any other category of person who acts for or on behalf of 
NSA/CSS as determined by the Director, NSA/Chief, CSS. (Source: NSA/CSS Policy 
Glossary ) 
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23. Classification Advisory Officer (CAOl - An individual trained to properly apply 
elassification rules and guidance and who assists other employees in the proper marking and 
protection of classified and protected information. The Information Policy and Classification 
Division (PI31) administers the CAO Program and registers CAOs. For more information “go 
CAO.” 


24. Logo - An unclassified graphical representation of an NSA/CSS-related special 
office, mission, program, or project. 

25. Name Check - A review of past assignments, including assignments to other agencies 
and participation in educational programs, to determine the classification of an individual’s name 
in association with NSA/CSS (Reference el . 

26. Nondisclosure Agreement (NdA) - A lifetime obligation to safeguard all protected 
information, to submit all information intended for publication and/or public release for 
prepublication review, and to report any unauthorized disclosure of protected information. 
NSA/CSS affiliates are legally bound and obligated by any NdAs they sign for access to 
NSA/CSS information. They shall not confirm or deny information about NSA/CSS that appears 
in the public domain without prior approval through the classification or prepublication process. 

27. NSA/CSS Protected Information - Information obtained as a result of a relationship 
with NSA/CSS, that is: 

a. Classified or in the process of a classification determination pursuant to the 
standards of Executive Order 13526 (Reference g) . or any successor order, and 
implementing regulations. It includes, but is not limited to, intelligence information, 
sensitive compartmented information (intelligenee sources and methods), and cryptologic 
information (information concerning information systems security and signals 
intelligence); or 

b. Unclassified, appearing in any form or compilation, which NSA/CSS may 
withhold Ifom public disclosure under authority of the National Security Agency Act of 
1959 (Reference h) or by reason of being either excluded or exempted from the 
mandatory disclosure requirements of the Freedom of Information Act (Reference it . 
(Source: NSA/CSS Policy Glossary! 

28. Official Capacity - Acting on behalf of NSA/CSS. 

29. Official NSA/CSS Information - Any NSA/CSS, DoD, or IC information that is in 
the custody and control of NSA/CSS and was obtained for or generated on NSA/CSS’ behalf 
during the course of employment or other service, whether contractual or not, with NSA/CSS. 

30. Prepublication Review - The overall process to determine that information proposed 
for public release contains no protected information and, where applicable, is consistent with 
established NSA/CSS, DoD, and IC policies and programs; conforms to NSA/CSS messaging 
standards as determined by Strategic Communications; and, in consultation with the NSA OGC, 
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Acquisition, Research, and Technology Law Practice, as appropriate, contains no information in 
which NSA/CSS may have intellectual property rights and may file a patent application, thereon. 

31. Prepublication Review Authority - Officials in organizations who are delegated the 
authority to make determinations on prepublication reviews. The Information Security and 
Classification Division (PI31) serves as the corporate-level Prepublication Review Authority and 
as such has the authority to make a determination on any prepublication review and has sole 
authority for the prepublication review of personal resumes, associated cover letters, bios, and 
CVs. The Chief, Office of Information Management (OIM, P13) has officially delegated 
Prepublication Review Authority to the Research Directorate for review of RD-related, non¬ 
resume material and/or non-rdsume material submitted by RD personnel. 

32. Private Capacity - Acting on behalf of oneself and not in association with NSA/CSS. 

33. Public Release - The decision to give permission to retain, or to show or reveal 
official NSA/CSS information whether orally, in writing, or through any other medium, to one or 
more persons who otherwise do not have the appropriate access authorization, security clearance, 
and/or need to know to receive such information upon determination that the release will not 
harm the national security or another legitimate Government interest. 

34. Senior Leader - A Defense Intelligence Senior Executive Service (DISES) employee, 
a Defense Intelligence Senior Level (DISL) employee, or the military equivalent of a DISES or 
DISL employee. 

35. Unauthorized Disclosure - Absent a public release, the communication or physical 
transfer of protected information to one or more unauthorized recipients who do not have 
appropriate aceess authorization, security clearance, and/or need to know to receive such 
information. 
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